Detecting Malicious Activity with DNS Backscatter Kensuke Fukuda John Heidemann Proc. of ACM IMC '15, pp , 2015.

Transcription

1 Detecting Malicious Activity with DNS Backscatter Kensuke Fukuda John Heidemann Proc. of ACM IMC '15, pp , Presented by Xintong Wang and Han Zhang Challenges in Network Monitoring Need a better monitoring service for network-wide activities Malicious activity: Spammer, scanner Non-malicious activity: Ad tracker, CDN Hard to achieve: Decentralized nature Reverse DNS (DNS Backscatter) provides a centralized strategic point Reverse DNS DNS Backscatter Sensor

2 DNS Backscatter DNS backscatter is the set of reverse DNS queries observed by a DNS authority Cache happens at all layers Final authority vs. root authority Final authority sees all queries for a specific originator Root authority should see all originators, if not cached Privacy Concerns over DNS traffic Get approval from IRB (though sometimes an IRB review is not enough) Reasons to address privacy concerns in this case: Caching and shared cache mask individual traffic, focusing on prevalent network activity instead Authorities have little interaction with targets due to recursive resolvers Mostly automated traffic, not human traffic, in reverse DNS Methodology - Datasets Collected at authorities One national authority managing.jp country TLD, two root servers (B, M) out of 13 And a final authority? (Not clear in the paper) Format: (originator, querier, authority) tuple Methodology - Features Derive static features from querier s domain name (mail.google.com) mail, ns, firewall, cdn, nxdomain, etc Dynamic features from query patterns queries per querier, unique ASes, unique countries, etc Classes for originator ad-tracker, cdn, cloud, mail, spam, etc Manually label originators for training

3 Constraints in Backscatter Limited information about targets Based only on querier domain name Backscatter is spread over multiple authorities due to anycast Could be tricked by careful spammer. Only increase the cost at certain degree Outline DNS Backscatters Methodology Validation Evaluation Validation Select appropriate features Label ground truth Choose learning algorithm Validate through cross-validation Select Appropriate Features Static features to distinguish different classes of originators Static features from domain names of the queriers Originator classes

4 Select Appropriate Features Dynamic features to distinguish different classes of originators Label Ground Truth Generate moderate to large lists of potential IP addresses in each application class from external sources; Intersect with the top originators in dataset by the number of queries; Manually verify intersection Choose Learning Algorithm Classification Accuracy Learning algorithms: Classification And Regression Tree (CART) Random Forest (RF) Kernel Support-Vector Machines (SVM) Metrics: Accuracy: (tp + tn) / all Precision: tp / (tp + fp) Recall: tp / (tp + fn) F1-score: 2tp / (2tp + fp + fn) Benchmark: 0.08 accuracy for randomly guessing Roots are attenuated (B post-ditl & M ditl)

5 Discriminative Features Gini Impurity Larger Gini values indicate features with greater discriminative power. Evaluate DNS Caching Backscatter is highly attenuated due to disinterested targets and DNS caching. Roughly 1 querier per 1000 targets Results - Size of Originator Footprints There are hundreds of originators that touch large parts of the Internet Classification of Top Originators Focus on the originators with the largest footprints; Understand the type of activity and the aggressiveness of activity. (Log-log scale)

6 Results - Trends of Network-wide Activities Results - Trends of Network-wide Activities Fluctuations of originators may be explained by reactions to network security Public announcement of the Heartbleed vulnerability events. (a security bug in the OpenSSL cryptography library) The number of originators in each originator class for each dataset Big footprints are often unsavory activities! Results - Trends of Network-wide Activities Results - Trends of Network-wide Activities Heartbleed Shellshock Very large scanners come and go.

7 Contributions Identify DNS backscatter as a new source of information about benign and malicious network-wide activity; Keep in mind of privacy and address any potential related issues in paper; Collect trainable dataset with ground truth label; Understand the type and trend of network-wide activity based on classifications; Discussions Adoption of botnets to circumvent the system Intentionally camouflage network traffic at each originator The possibility of other prominent features The possibility of other classifiers Limited training data The number of data points in some application classes is too small